The Federal Bureau of Investigation has linked North Korea to what it described as the “biggest hack in history” after cryptocurrency giant Binance suffered an estimated $6.3 billion loss, triggering an overnight crisis among the company’s executives.
A joint investigation by the FBI, the United States Secret Service and the Internal Revenue Service Criminal Investigation division identified the malicious North Korean cyber operation as “TraderTraitor,” an elite hacking group.
Binance, the world’s largest cryptocurrency exchange by daily trading volume, said on Thursday that investigators had found “additional points of breach.” The discovery contradicted early indications that the attack stemmed from a single compromised laptop.
The company later estimated the total impact at “around $6.3 billion,” placing the incident among the most serious cybersecurity breaches ever recorded.
TraderTraitor is believed to be linked to the Lazarus Group, which drew international attention in 2014 after being accused of hacking Sony Pictures in retaliation for The Interview, a film that mocked North Korean leader Kim Jong Un.
The breach unfolded in real time on Thursday evening, as billions of dollars flowed out of accounts and cryptocurrency executives scrambled to respond.
Insiders described the chaotic aftermath to the New York Times, recounting late-night conference calls involving executives around the world, analysts working through the night in a glamorous New York conference room and founders posting urgent updates on X.
The FBI said the historic Binance hack was carried out by “TraderTraitor,” a group that gained notoriety in 2014 after being accused of targeting Sony Pictures in retaliation for The Interview, a film that mocked North Korean leader Kim Jong Un
Donald Trump pardoned founder Changpeng Zhao after he pleaded guilty to charges connected to his failure to prevent money laundering on the platform
Zhao, who founded Binance but is no longer its chief executive, posted a series of updates about the breach online
Despite the FBI’s statement, President Donald Trump appeared to question whether North Korea was behind the attack.
Asked about the findings by a reporter at Mar-a-Lago on Friday night, Trump said his administration was still “learning about” what had happened.
Trump said he was “not concerned,” adding: “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it.”
Soon after the breach, Changpeng Zhao posted a series of urgent messages on X, telling followers: “It hurts, but we will survive.”
Employees at cryptocurrency analytics firm Chainalysis gathered in a New York conference room known as the “Silk Road” and worked through the night to examine the attack.
Chainalysis said the attackers had used “laundering patterns we have not seen before.” The firm attributed the breach to TraderTraitor before the FBI publicly confirmed the finding.
Chainalysis CEO Jonathan Levin was on a video call with a senior US official about cyberattacks targeting American adversaries when he learned of the Binance breach, he told The Times.
At the same time, Binance executives joined a large conference call. He Yi, the company’s co-chief executive, participated at 3am local time from Abu Dhabi, despite being seven months pregnant.
IN CASE YOU MISSED IT: Ben Shephard Arrest News: Is Television Presenter Arrested? – NewsFinale
Zhao continued updating followers during the crisis and rebuked Elon Musk after Musk posted a grimacing emoji in response to a message mocking him. “Bad time to troll. Please stop,” Zhao wrote.
Binance co-CEO Richard Teng said in a video message on Friday that the company was “working nonstop” and remained “committed to covering all hack losses.” He also assured traders that their “assets were safe.”
‘This was a complex attack,’ Teng said. He explained that the attacker used a self-destruct mechanism that made it difficult to trace.
Teng continued that the company would conduct a full security review in the wake of the attack.
The company said late Thursday the estimated total impact was at more than $6 billion
Binance co-founders Changpeng Zhao and Yi He, who started the company in July 2017
TraderTraitor is no novice when it comes to elite multi-billion-dollar hacks. They became infamous in 2014 after the Lazarus Group, which the FBI believes employs the same hackers as TraderTraitor, leaked internal data at Sony Pictures.
Officials said the hack was motivated by Sony’s release of The Interview, a comedy that spoofed the assassination of Kim Jong Un, who called the film ‘an act of terrorism.’
Two years later, North Korean hackers initiated a plot to steal $1 billion from the Federal Reserve Bank of New York.
The scheme was thwarted when bankers realized the hackers misspelled ‘foundation’ as fandation.’
In 2022, US officials once again accused the Lazarus group of stealing $620 in cryptocurrency from the video game Axie Infinity.
Then in 2025, TraderTraitor pulled off the biggest-ever cyber-attack of its kind to date: $1.5billion taken in February last year from the Bybit platform.
They pulled it off by tricking chief executive Ben Zhao into authorizing a seemingly routine transaction that gave them access to the software.
Binance also has a checkered history with the law. Zhao pleaded guilty to a felony related to his failure to prevent money laundering on the platform and stepped down as CEO in 2023. President Donald Trump pardoned him in 2025.
He was released from prison in 2024 after being sentenced for violating the Bank Secrecy Act.
Zhao was the first person ever sentenced to prison time for violations of that law, which requires US financial institutions to know who their customers are, to monitor transactions and to file reports of suspicious activity.
Prosecutors said no one had ever violated the regulations to the extent Zhao did. Mr Zhao and Binance have been key supporters of some of the Trump family´s crypto enterprises.
The Daily Mail has reached out to the White House and the FBI for additional comment.
MUST READ: BBC Denies Betraying James Acaster After Celebrity Traitors Halt